Module token_provider 

Token acquisition: TokenProvider, OAuth 2.0 client-credentials, and OIDC discovery.

The pieces compose left to right:

1. A TokenProvider produces a bearer access token on demand.
2. BearerAuthInterceptor asks its provider for a token before every request and injects Authorization: Bearer <token> — so a token that rotates or refreshes mid-session is always current (unlike a credential frozen at connect time).
3. OAuth2ClientCredentials is the batteries-included provider: it runs the RFC 6749 §4.4 client-credentials grant against a token endpoint, caches the token, refreshes it shortly before expiry, and collapses concurrent refreshes into a single request.

Quick start

use std::sync::Arc;
use a2a_protocol_client::token_provider::{BearerAuthInterceptor, OAuth2ClientCredentials};
use a2a_protocol_client::ClientBuilder;

let provider = Arc::new(
    OAuth2ClientCredentials::new(
        "https://auth.example.com/oauth/token",
        "my-client-id",
        "my-client-secret",
    )
    .with_scopes(["tasks:read", "tasks:write"]),
);

let client = ClientBuilder::new("https://agent.example.com")
    .with_interceptor(BearerAuthInterceptor::new(provider))
    .build()?;

Card-driven configuration

An AgentCard that declares an OAuth 2.0 security scheme with a client-credentials flow carries the token endpoint; OAuth2ClientCredentials::from_agent_card reads it so the only thing you supply is your credentials. For an openIdConnect scheme, OAuth2ClientCredentials::from_oidc_issuer fetches the issuer’s discovery document and uses its token_endpoint.

Interactive flows

Authorization-code (browser redirect) and device-code flows are interactive by nature and out of scope for an agent-to-agent SDK; supply your own TokenProvider implementation if your deployment uses one.

Structs

BearerAuthInterceptor

A CallInterceptor that injects Authorization: Bearer <token> from a TokenProvider before every request.

OAuth2ClientCredentials

A TokenProvider implementing the OAuth 2.0 client credentials grant (RFC 6749 §4.4) with caching and proactive refresh.

StaticTokenProvider

A TokenProvider that always returns the same fixed token.

Enums

TokenEndpointAuthStyle

How client credentials are presented to the token endpoint.

Traits

TokenProvider

A source of bearer access tokens.

Functions

discover_token_endpoint

Fetches {issuer}/.well-known/openid-configuration and returns its token_endpoint.